Viasat Inflight Wi-Fi Privacy Policy 


nu 


Viasat, Inc. and its subsidiaries and affiliates (collectively, “Viasat,” “we,” “us,” or “our”) respect and value your 
privacy. This Privacy Policy (“Policy”) provides you with notice regarding how we collect, use, and share (collectively, 
“process”) data about you in connection with the Services, including the choices we offer with respect to that 
information. This Policy applies to your use of any of our services, in particular the Viasat in-flight Wi-Fi internet 
service and related products and services provided by us to which you connect on the airline operator’s aircraft 
(“Airline”) (collectively the “Services”), regardless of how you access or use it, whether by computer, mobile 
device, consumer electronics device or otherwise. Any term with initial capitalized letters used as a defined term, 
but not otherwise defined in this Policy, shall have the meaning set forth in our Terms of Service. This Policy does 
not apply to Viasat’s data processing activities offline or otherwise outside of the Services (unless otherwise stated 
below or at the time of collection). This Policy may be supplemented by additional privacy notices posted on the 
Services (in each such instance, the “Additional Privacy Terms”), which will govern in the event of a conflict with 
this Policy. When you access Third-Party Services (defined in Section 4 below), including those of the Airline, from 
or in connection with our Services, their policies and terms and conditions govern those services. 


e = Viasat, Inc. located in the United States is the data controller responsible for Services offered by Viasat in 
the U.S., the European Economic Area, and other geographies where the Services are offered, except as 
otherwise stated in this Policy. 


e Viasat Brasil Servicos de Comunicac6es LTDA located in São Paulo, Brazil is also a data controller for Services 
offered by Viasat in Brazil. 


e Viasat Tecnologia, S.A. de C.V. with an office located at Montes Urales 754, piso 3, colonia Lomas de 
Chapultepec, alcaldia Miguel Hidalgo, C.P. 11000, in Mexico City, Mexico is also a data controller for Services 
offered by Viasat in Mexico. 
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Contents 

1. INFORMATION COLLECTION AND SOURCES 

A. Personal Information 

B. Non-Personal Information 

C. Children and Minors 

D. How Information is Collected 

HOW WE PROCESS INFORMATION AND OUR LAWFUL BASES 
INFORMATION SHARING AND DISCLOSURE 

THIRD-PARTY SERVICES, SOCIAL FEATURES, AND ANALYTICS 
YOUR CHOICES 

A. Account Information 

B. Your Rights 

C. Tracking Technologies and Analytics 

6 YOUR CALIFORNIA PRIVACY RIGHTS 

7. INTERNATIONAL DATA TRANSFERS 

8. DATA SECURITY 

9. CHANGES TO PRIVACY POLICY 

10. HOW TO CONTACT US 


URLAN, 


1. INFORMATION COLLECTION AND SOURCES 


Viasat may collect information about you when you use our Services, when we request information directly from 
you, or when you contact us (collectively “Information” ). The Information falls into the following categories, which 


we treat differently under this Policy: Personal Information (“PI”), Viasat-Collected Pl, and non-Personal Information 
(each as defined below). This section explains each category of data and how we collect this data from you. We 
may use contractors to help us provide the Services (“Vendors”) and they, in that capacity, may collect the 
Information. Any Personal Information collected by our Vendors on our behalf will be treated as Viasat-Collected 
PI under this Policy. 


A. Personal Information 


Information that Viasat and its Vendors, and/or Third-Party Services, may collect includes personally identifiable 
information, which is any information relating to an identified or identifiable natural person (“Personal 
Information”). Examples of Personal Information or PI include your first and last name, e-mail address, phone 
number, address, full payment account number, and IP addresses, as well as demographic information such as 
gender, age, zip code, interests, and recent and upcoming purchases. To the extent any non-Personal Information 
(defined below) is combined by, or on behalf of, Viasat with Personal Information Viasat itself collects directly from 
you on the Services (“Viasat-Collected PI”), we will treat the combined data as Personal Information under this 
Policy. 


B. Non-Personal Information 


Information that Viasat and its Vendors, and/or Third-Party Services, may collect includes certain information about 
you when you access or use the Services (“Usage Information”). Usage Information may include browser type, 
operating system, information about your use of the Services, and data regarding network-connected hardware 
(e.g., computer or mobile device). Usage Information that is “de-identified” (i.e., the removal of personal identifiers 
from data to make it no longer personally identifiable) is considered under this Policy to be data that is not Personal 
Information (“non-Personal Information”), which may be used and shared without obligation to you, except as 
prohibited by applicable law. 


C. Children and Minors 


Our Services are not directed to children under 13 (or older, if applicable law provides for different protections) and 
we do not knowingly collect personal information from children. If you believe that we are processing the personal 
information pertaining to a child inappropriately, please contact us using the information provided under the “How 
to Contact Us” section below. 


D. How Information is Collected 


(1) Information You Provide to Us 


You may provide us with Information when you register for or use our Services. Personal Information that we 
process may include your name, address, email address, phone number, Airline frequent flyer account number, and 
a credit or debit card number or other financial or payment-related information. We will retain your Personal 
Information for the period necessary to fulfill the purposes outlined in this Policy, as needed to provide Services, and 
to comply with our legal obligations. 


(2) Information Automatically Collected 


When you use our Services, we may use cookies, log files, or other now and hereafter developed tracking 
technologies (“Tracking Technologies”) to collect Information. Tracking Technologies help us automatically collect 
certain Information without you affirmatively providing it to us. This may include processing of data regarding your 
login credentials, browser type, operating system, software version, Internet Protocol (IP) address or device MAC 
address, and platform types, as well as or in combination with Usage Information. 


Viasat also may process Usage Information relating to your use of the Services, including but not limited to, data 
consumed, hours of usage, the amount of time it takes to load a page, clicks to available links, and other data that 
helps us to track and understand how users experience our Services, as well as information about the websites you 
visit when using the Services. This information helps us, for instance, to improve the performance and user 
experience of our Services, including to optimize, troubleshoot, measure, and monitor the performance of our 
network and Services, including performing de-bugging, measuring service levels and identifying loading trends in 
order to deliver internet traffic more efficiently. 


(3) Information You Post 


Any information, including comments and Personal Information that you post on public pages or our Services or 
Third-Party Services is publicly available and may be processed by Viasat. Viasat is not responsible for the accuracy 
of any information contained in those postings. 


(4) Tracking Technologies 


The Tracking Technologies that you may encounter using our Services, both on our Services and on Third-Party 
Services, may include cookies as described herein: 


Cookies. Cookies are alphanumeric identifiers that we transfer to your computer’s hard drive through your 
browser to enable our systems to recognize your browser. Cookies allow a web server to transfer data to 
a computer for recordkeeping and other purposes. We, our Vendors, and third parties with whom we have 
a commercial relationship may use “cookies” in association with our Services for a variety of purposes, such 
as to facilitate your ongoing access to and use of the Services, as well as to conduct analytics on and collect 
Usage Information related to our Services. Third- Party Services may also associate cookies with you, but 
we are not responsible for that. 


For example, we may use cookies to remember your username and password, if you choose to store them. 
We may also use cookies to determine when your current session on the Services should be logged out 
after a period of no activity, as well as for efficient management of the servers providing our Services. We 
also may use cookies to generate analytics and aggregate information relating to your interactions with the 
Services, including for example time spent on a page, or clicks to other pages or links. We and our Vendors 
may use both session-based cookies and persistent cookies. 


Session Cookies. Session cookies exist only during an online session and disappear from your computer 
when you close your browser or turn off your computer. We may use session cookies to, for instance, allow 
our systems to uniquely identify you during a session or while you are logged in to the Services. This allows 
us to process your online transactions and requests and verify your identity, after you have logged in, as 
you move through our Services. 


Persistent Cookies. Persistent cookies remain on your computer after you have closed your browser or 
turned off your computer. We may use persistent cookies to, for instance, allow our systems to remember 
you and automatically log you in to our Services. 


Some information about your use of the Services and certain Third-Party Services may be collected using Tracking 
Technologies across time and services, and used by Viasat, our Vendors, and third parties for purposes such as to 
associate different devices you use, and conduct analytics. See Section 5.C regarding certain choices regarding these 
activities. 


2. HOW WE PROCESS INFORMATION AND OUR LAWFUL BASES 


The processing of Personal Information as described in this Policy is carried out based on the following legal bases: 


e To provide you with the Services that you have agreed to, including within the Terms of Service; 


e Our compliance with a legal or regulatory obligation; 
e For the regular exercise of Viasat’s rights, if necessary; and 


e Where we or our partners, including the Airline on which you are flying, have a legitimate interest that is not 
overridden by your interests and fundamental rights; for example, our legitimate interest in providing Services 
and marketing to customers, preventing fraud and managing and operating our business, and fulfilling 
obligations to third parties with whom we have commercial relationships, such as the Airline on which you are 
flying, for purposes of making our Services available to you. 


Viasat and our Vendors may process the Information for any purpose stated in this Privacy Policy or Additional 
Privacy Terms, including for the following business purposes: 


° To provide the Services and communicate with our customers, including to process and complete 
transactions, including those that you request in relation to the Services or affiliated services; 


° To develop new products or services; 
° To identify and/or contact you; 
° To optimize, troubleshoot, measure and monitor the performance of our network and Services, including 


performing de-bugging, measuring service levels and identifying loading trends and websites that are 
statistically significant to our user population in order to deliver internet traffic more efficiently; 


° To address problems with the Services or our business; 
° To protect the security or integrity of the Services and our business; and/or 
° To use and disclose your credit/debit card information or other financial or payment-related information 


only to process payments and prevent fraud. 
We also may use the Information for the following commercial and marketing purposes: 


° To market our Services and related services to you; and/or 


° To contact you with information and promotional materials from Viasat or on behalf of our partners and 
affiliates; and/or 


° To develop or deliver other products or services in collaboration with the Airline on which you are flying 
We also may use the Information that we collect as described to you at the point of collection. 
3. INFORMATION SHARING AND DISCLOSURE 


Viasat shares your Information, including Personal Information, with third parties for purposes consistent with this 
Policy. Further, we will not share Viasat-Collected PI with third parties for their own direct marketing purposes, 
unless we give you appropriate choice (either opt-in or opt-out depending on applicable law). The business purposes 
for which we may share your information include the following: 


° We may disclose your Information to partners, Vendors or others who perform functions on our behalf 
related to the Services; 


° We may disclose your Information to outside auditors, professional advisors, and potential business 
transition partners; 


° We may disclose your Information to an affiliated service that you have requested, only as necessary to 
enable the service; 


° We may disclose your Information where we believe it is necessary to investigate, prevent, or take action 
regarding illegal activities, suspected fraud, potential threats to the safety or property of any person or 
entity (including Viasat), or violations of our Terms of Service or policies; and 


° We may disclose your Information to credit bureaus, in connection with obligations set forth by relevant 
legislation on the processing of data for credit reporting purposes. 


We also may disclose your Information to the Airline on which you are flying in connection with their operational or 
commercial purposes, and otherwise may disclose your Information based on your consent. 


We also may share Information in the following additional circumstances: 


° In connection with Viasat being acquired by or merged with another company, or in the event of a 
consolidation or reorganization involving Viasat, or if all or a portion of our assets are transferred to another 
company, or as part of a bankruptcy proceeding or as part of a similar transaction, we may disclose, and 
may further transfer, the Information to the acquiring company or other involved third party (including 
without limitation in connection with due diligence regarding any potential such transaction); 


° We may disclose your Information to law enforcement, government officials, regulatory agencies, or other 
parties when we are required to do so by applicable law. 


° We may disclose your Information to respond to legal process, such as to comply with a judicial proceeding, 
a subpoena or court order, to comply with the law, or to protect our rights in litigation or arbitration; 


4. THIRD-PARTY SERVICES, SOCIAL FEATURES, AND ANALYTICS 


The Services may include hyperlinks to, or include on or in connection with, the Services (e.g., apps and plug-ins), 
websites, locations, platforms, applications or services operated by third parties (“Third-Party Service(s)”), and you 
can use the Services to navigate to view and use Third-Party Services. These Third-Party Services may use their own 
cookies, web beacons, and other tracking technologies to independently collect information about you and may 
solicit Personal Information from you. 


Certain functionalities on the Services may permit interactions that you initiate between the Services and certain 
Third-Party Services, such as third-party social networks (“Social Features”). Examples of Social Features include: 
enabling you to send content such as contacts and photos between the Services and a Third-Party Service; “liking” 
or “sharing” our content; logging in to the Services using your Third-Party Service account (e.g., using Facebook 
Connect to sign-in to the Services); and to otherwise connect the Service to a Third-Party Service (e.g., to pull or push 
information to or from the Services). If you use Social Features, and potentially other Third-Party Services, 
information you post or provide access to may be publicly displayed on the Services (see Section 1.D(3)) or by the 
Third-Party Service that you use. Similarly, if you post information on a third-party service that references the 
Services (e.g., by using a hashtag associated with Viasat in a tweet or status update), your post may be used on or in 
connection with the Services or otherwise by Viasat. Also, both Viasat and the third party may have access to certain 
information about you and your use of the Services and any Third-Party Service. 


VIASAT MAY USE VENDORS FOR ANALYTICS SERVICES. These analytics services may use cookies and other Tracking 
Technologies to help analyze use of the Services. Vendors may use Information generated by these services, e.g., 
your IP address and other Usage Information to evaluate your use of the Services, compile statistic reports on the 
Services’ activity, and provide other services relating to Services activity and other internet usage. 


Except to the extent Viasat combines information from Vendors, Third-Party Services, or other third parties with 
Viasat-Collected PI, in which case Viasat will treat the combined information as Personal Information under this 
Privacy Policy (see Section 1.A), data obtained by Viasat from a third party, even in association with the Services, is 
not subject to Viasat’s limitations regarding Viasat-Collected PI under this Policy. The information third parties 


independently collect, store, and share remains subject to their privacy policies and practices, including whether 
they continue to share information with Viasat, the types of information shared, and your choices on what is visible 
to others on third-party services. 


Viasat is not responsible for, and makes no representations or warranties regarding, the policies or business practices 
of any third parties, including, without limitation, any informational content, products, services, software, or other 
materials available on an external website. Viasat encourages you to familiarize yourself with and consult their 
privacy policies and terms of use. See Section 5 for more on certain choices offered by some third parties regarding 
their data collection and use, including regarding analytics. 


5. YOUR CHOICES 


A. Account Information 


You may update or change your account contact and billing information by reaching us at the contact information 
below. Viasat will make good faith efforts to make requested changes in our then-active databases as soon as 
practicable, but it is not always possible to completely change, remove, or delete all of your information or public 
postings from our databases and residual and/or cached data may remain archived thereafter. Further, we reserve 
the right to retain data (a) as required by applicable law; and (b) for so long as reasonably necessary to fulfill the 
purposes for which the data is retained to the extent permitted by applicable law. 


If you would like to opt-out of receiving direct marketing communications from us, you may do so by following any 
instructions included in the communication or by contacting us at the contact information provided below. 


B. Your Rights 


To the extent provided by the law of your jurisdiction, you have the right to: (a) confirm whether we process Personal 
Information about you; (b) access certain Personal Information we maintain about you; (c) exercise your right to 
data portability; (d) request that we update, correct or rectify, amend, cancel or delete, or restrict your Personal 
Information; (e) withdraw your consent previously given; (f) request that we not share your Personal Information 
with third parties for ancillary or competing services; and/or (g) object at any time to the processing of your Personal 
Information on legitimate grounds relating to your particular situation. We will comply with such requests to the 
extent required by the applicable law of your jurisdiction. We will take appropriate steps to verify your identity 
before granting you access to your information, which may require that you provide us with additional information. 
We may apply a charge, to the extent permitted by applicable law, before we provide you with a copy of any of your 
Personal Information we maintain. You may, depending on your location, have a right to file a complaint with a 
government regulator if you are not satisfied with our response. 


To exercise the above rights, please contact us using the information in the “How to Contact Us” section below. We 
will consider and process your request in a timeframe that complies with the relevant legislation in your jurisdiction. 


C; Tracking Technologies and Analytics 


Regular cookies may generally be disabled or removed by tools available as part of most commercial browsers, and 
in some instances blocked in the future by selecting certain settings. Browsers offer different functionalities and 
options so you may need to set them separately. Also, tools from commercial browsers may not be effective with 
regard to HTML cookies, or other Tracking Technologies. Please be aware that if you disable or remove these 
technologies, some parts of the Service (and Third-Party Services) may not work, and that when you revisit the 
Service your ability to limit browser-based Tracking Technologies is subject to your browser settings and limitations. 


Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit; 
however, there is no consensus among industry participants as to what “Do Not Track” means in this context. Like 
many online services, we currently do not alter our practices when we receive a “Do Not Track” signal from a user’s 


browser. To learn more about “Do Not Track,” visit http://www.allaboutdnt.com, but we are not responsible for the 
accuracy of this third-party information. Some third parties, however, may offer you choices regarding their Tracking 
Technologies. One way to potentially identify cookies on our Services (and Third-Party Services) is to add the free 
Ghostery plug-in to your browser (www.ghostery.com), which according to Ghostery will display for you traditional, 
browser-based cookies associated with the websites (but not mobile apps) you visit and privacy and opt-out policies 
and options of the parties operating those cookies. You may exercise choices regarding the use of cookies from 
Google Analytics by going to https://tools.google.com/dlpage/gaoptout or downloading the Google Analytics Opt- 
out Browser Add-on. You may exercise choices regarding the use of cookies from Adobe Analytics by going to 
http://www.adobe.com/privacy/opt-out.html. 


Viasat is not responsible for effectiveness of, or compliance with, any third-parties’ opt-out options or programs or 
the accuracy of their statements regarding their programs. 


6. YOUR CALIFORNIA PRIVACY RIGHTS 


We will only knowingly share Personal Information with third parties (such as the Airline on which you are flying) for 
their direct marketing purposes where you are given appropriate choice. California Civil Code Section 1798.83 
permits California residents who have provided to us their personal information as defined in the statute, to, under 
certain circumstances, exercise choice and inquire further about how to do so and how we comply with Section 
1798.83. To make such a request, please contact us, attest to the fact that you are a California resident, and provide 
a current California address for our response. You may make this request in writing at: Viasat, Inc., ATTN: Privacy 
Office, 6155 El Camino Real, Carlsbad, CA 92009. Your request must include “California Privacy Rights Request” in 
the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we 
are only required to respond to one request per customer each year, and we are not required to respond to requests 
made by means other than as described in this Section. 


California residents also may exercise the following rights under the California Consumer Privacy Act of 2018 
(“CCPA”): 


e Up to two times each year, you may request that we disclose to you the categories and specific pieces of 
personal information (as defined in the CCPA) that we have collected about you, the categories of sources 
from which your personal information is collected, the business or commercial purpose for collecting your 
personal information, the categories of personal information that we disclosed for a business purpose, the 
categories of third parties with whom we have shared your personal information, any categories of personal 
information about you that we sold, and the business or commercial purpose for selling your personal 
information, if applicable. 


e You may request that we delete personal information that we have collected from you, subject to certain 
exceptions. 


To exercise your rights, you can contact us at privacy@viasat.com or by calling us at 1-888-649-6711. If you exercise 
any of your rights, we will not discriminate against you, such as by denying you access to our services or restricting 
your access to products or services of a certain price or quality. 


For purposes of compliance with the CCPA, we make the following disclosures: 


e Wecollect the following categories of personal information: Identifiers, personal information described in 
Cal. Civ. Code 1798.80, internet or other electronic network activity information, characteristics of 
protected classifications under California or federal law, commercial information, and inferences drawn 
from the preceding categories of personal information. 


e We disclose the following categories of personal information for a business purpose: Identifiers, personal 
information described in Cal. Civ. Code 1798.80, commercial information, and internet or other electronic 
network activity information. 


e We do not sell your personal information. 
7. INTERNATIONAL DATA TRANSFERS 


Your Information may be transferred, stored and used in the United States or in other countries in which Viasat or 
its parent, subsidiaries, affiliates, Vendors, or Airline partners conduct operations, including for the purposes 
described in the “Information Sharing and Disclosure” section herein. These countries may have data protection 
laws that are different to the laws of your country (and, in some cases, may not be as protective). However, we have 
taken appropriate safeguards to require that your personal information will remain protected in accordance with 
this Privacy Policy. Where we operate as a data exporter under applicable law, we are committed to adopt all the 
necessary measures and safeguards as to the cross-border data flow, as set forth by the applicable legislation. The 
data transfers are made to our data processors in these countries to the extent that they are necessary for the 
maintenance or fulfillment of the legal relationship between you and Viasat, or where the transfer is necessary by 
virtue of a contract executed in your interest between Viasat and our service providers. When required by applicable 
laws, we will request appropriate consent from you for international data transfers. 


8. DATA SECURITY 


Viasat has taken certain physical, administrative, and technical steps to safeguard the Personal Information we 
collect from and about customers and visitors to our Services. While we seek to ensure the integrity and security of 
our network and systems, we cannot guarantee the security of the Information from misappropriation by hackers 
or from other nefarious or criminal activities, or in the event of a failure of computer hardware, software, or a 
telecommunications network. We encourage you to take precautions to protect your personal data when you are 
on the internet. In accordance with applicable law(s), we will notify you in the event we become aware of a security 
breach involving your Personal Information stored by or for us. 


9. CHANGES TO PRIVACY POLICY 

Viasat may amend this Policy from time to time. When we do, we will make the updated Policy available to you. If 
we make any material changes in the way we use or disclose your Personal Information, we will provide you with 
appropriate notice. 

10. HOW TO CONTACT US 

If you have any questions about this Policy or our handling of your Information, a request relating to the section 
entitled “Your Rights,” or to contact our Data Protection Officer, please send an e-mail to privacy@viasat.com. 


Policy Last Updated: June 30, 2020 
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